[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvwRSlBTjBd0RR6NEs7JYGXy9OS00lhE1Gd9D9QMhp_A":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":98},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"e6b5b208-8cb9-4694-9a96-39c43f305af3","CNIL (France) - SAN-2026-010","cnil-france-san-2026-010-fd7a66","← Older revision Revision as of 15:10, 29 September 2026 Line 92: Line 92: }} }} The DPA fined consulting firm EXTIA €300,000 for failing to properly handle erasure requests and to inform data subjects of the outcome of their requests in accordance with [[Article 12 GDPR|Articles 12]] and [[Article 17 GDPR|17 GDPR]]. The DPA fined a consulting firm €300,000 for failing to properly handle erasure requests and to inform data subjects of the outcome of their requests. The requests were related to the recruitment activities of the controller. == English Summary == == English Summary ==","France's CNIL has fined consulting firm EXTIA €300,000 for failing to properly handle data erasure requests and inform data subjects of the outcomes. The violations, related to recruitment activities, included unprocessed requests, delayed responses, and failure to notify individuals, despite EXTIA's arguments about automatic deletion and departmental disorganization.","CNIL fines EXTIA €300,000 for GDPR violations related to data erasure requests.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CNIL_(France)_-_SAN-2026-010&diff=53225&oldid=53210","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fthumb\u002F0\u002F0f\u002FLogoFR.png\u002F1200px-LogoFR.png","2026-09-29T15:10:22+00:00","2026-09-29T16:00:40.447705+00:00",7,[17,20,23],{"name":18,"type":19},"CNIL","vendor",{"name":21,"type":22},"GDPR","product",{"name":24,"type":19},"EXTIA","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,35,40,42],{"category":32},{"id":33,"icon":27,"name":21,"slug":34},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":36},{"id":37,"icon":27,"name":38,"slug":39},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":41},{"id":25,"icon":27,"name":28,"slug":29},{"category":43},{"id":44,"icon":27,"name":45,"slug":46},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,24,21],{"controls":50,"vendors":97},[51,80],{"slug":52,"name":53,"problem":54,"products":55},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":81,"name":82,"problem":83,"products":84},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[85,91],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":86,"product_name":87,"url":89,"description":90},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":92,"product_name":93,"url":95,"description":96},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":99,"title":100,"body":101,"framework_refs":102,"framework_notes":112},"extia-fined-300k-for-failing-to-honor-gdpr-data-erasure-requests","EXTIA Fined €300K for Failing to Honor GDPR Data Erasure Requests","French consulting firm EXTIA was fined €300,000 by the CNIL for systematically failing to process data subject erasure requests, respond within legal timeframes, and notify individuals of outcomes — all core obligations under GDPR Article 17. The root cause was a combination of poor internal processes, departmental disorganization, and an over-reliance on assumed automatic deletion mechanisms that were never properly verified. This case illustrates that 'we meant to delete it' is not a defensible compliance posture under EU data protection law. Organizations handling personal data in recruitment or HR contexts must treat data subject rights as operational obligations, not administrative afterthoughts. The financial and reputational consequences of ignoring these duties are significant and growing.",[103,104,105,106,107,108,109,110,111],"GDPR Article 17 – Right to Erasure ('Right to be Forgotten')","GDPR Article 12 – Transparent Information and Communication (response timelines)","GDPR Article 5(1)(e) – Storage Limitation Principle","GDPR Article 24 – Responsibility of the Controller","NIST SP 800-53 IP-3 (Information Management and Retention)","NIST Privacy Framework PR.DS-P4 (Data Retention and Disposal)","CIS Control 3 – Data Protection (Data Retention and Disposal)","ISO\u002FIEC 27701:2019 – Section 7.3.4 (Obligations to Data Subjects)","ITIL Service Management – Request Fulfilment Process",{}]